Threat Actors Fake FBI IC3 Portal to Steal Visitor Information

Threat actors are spoofing the FBI’s IC3 portal to harvest visitor information, with the aim of tricking people into filing reports on fraudulent sites that mimic IC3[.]gov. According to FBI Alert I-091925-PSA, released on 19 September 2025, these fraudulent websites use subtle domain alterations, different top‑level domains, and character substitutions to deceive users.

The spoofed sites are designed to collect personally identifiable information such as names, home addresses, phone numbers, email addresses, and banking details. The FBI’s guidance urges users to verify authenticity by typing the official URL directly into the browser, ensure the site ends with the official .gov domain, avoid suspicious links, and report suspicious activity only through the legitimate IC3 portal.

The alert also notes that IC3 will never request payment to recover funds and does not maintain a social media presence or refer users to companies for fund recovery.